feat: publish run observations and manifest

[incendiary]

Summary

• publish dns-observations-v1.json from existing wildcard, takeover, unresolved, and provider-catalogue output
• publish run-manifest-v1.json last as the complete/incomplete/failed run marker
• keep actionable output null for incomplete and failed runs, and replace stale run documents
• retain every legacy text output and update the public contract documentation

Verification

• Ruff check and format check passed
• baseline: 5 passed
• full suite: 320 passed, 95% coverage for classes and imports
• focused contract/integration suite: 32 passed
• Gitleaks: no leaks in the commit range
• TruffleHog v3.96.0: zero verified or unverified secrets in the commit range

Live acceptance

• production system-resolver run fetched complete AWS, GCP, and Azure catalogues
• published 20 schema-valid allocator targets, an empty schema-valid observation array, and a schema-valid complete manifest
• reserved does-not-exist.example.com negative control published one unresolved observation, an empty actionable array, and a complete manifest
• no run-document temporary files remained

Direct public-resolver transport and real allocator-consumer compatibility remain delegated through docs/EXTERNAL-ACCEPTANCE.md.